Pass credentials as well (needed for the ajax workaround)

Ah, that's much more clear. Thanks.